8362 matches found
Improper access control
"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5...
Improper access control
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5...
CVE-2020-5288
CVE-2020-5288 affects PrestaShop versions 1.7.0.0–1.7.6.5, with improper access controls on the product attributes page. The root cause is access control misconfigurations that could expose resources to unauthorized roles. The issue is fixed in version 1.7.6.5. No exploitation details are provide...
CVE-2020-5293
PrestaShop CVE-2020-5293 involves improper access controls on the product page (combinations, attachments, and specific prices) affecting versions 1.7.0.0 through 1.7.6.5. The vulnerability is fixed in 1.7.6.5. The Red Hat and other CVE mirrors reiterate this issue. Practical impact as stated: at...
NERC CIP Compliance in Azure vs. Azure Government cloud
As discussed in my last blog post on North American Electric Reliability Corporation—Critical Infrastructure Protection NERC CIP Compliance in Azure, U.S. and Canadian utilities are now free to benefit from cloud computing in Azure for many NERC CIP workloads. Machine learning, multiple data...
Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins
Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF. PoC...
CVE-2019-14070
Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...
Race condition
Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired...
PT-2020-2495 · Oracle · Oracle Outside In Technology
Name of the Vulnerable Software and Affected Versions: Oracle Outside In Technology versions 8.5.4 Description: The issue is related to insufficient access controls in the Outside In Filters component of Oracle Outside In Technology, a suite of software development kits SDKs. This can be exploite...
Cisco Webex Meetings Access Control Error Vulnerability
Cisco Webex Meetings is a set of video conferencing solutions from Cisco USA. An access control error vulnerability exists in the Multimedia Viewer feature of Cisco Webex Meetings, which originates from a security warning dialog box that does not pop up when the host of the meeting room views a...
VMware vCenter Server 6.7 Sensitive Information Disclosure Vulnerability (VMSA-2020-0006)
The version of VMware vCenter Server installed on the remote host is 6.7 prior to U3F, and is, therefore, affected by an information disclosure vulnerability caused by insufficient access controls in vmdir. This allows an attacker with network access to an affected vmdir deployment may be able to...
CVE-2020-3952
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls...
CVE-2020-3952
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls...
CVE-2020-3952 - VMware vCenter Server vmdir Information Disclosure
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. Recent assessments: wvu-r7 at April 16, 2020 1:25pm UTC reported: Technical details on the vuln are out:...
An update that enables Internet Explorer in Windows Vista or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available
An update that enables Internet Explorer in Windows Vista or in Windows Server 2008 to parse fragmented TLS/SSL handshake messages is available Warning: The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain...
CVE-2019-18802
A flaw was found in envoy. A malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
Secure Remote Working During COVID-19 — Checklist for CISOs
Coronavirus crisis introduces a heavy burden on the CISOs with the collective impact of a mass transition to working remotely coupled with a surge of cyberattacks that strive to monetize the general chaos. Security vendors, unintendedly, contribute to this burden by a relentless generation of noi...
Protecting your data and maintaining compliance in a remote work environment
In this difficult time, remote work is becoming the new normal for many companies around the world. Employees are using tools like Microsoft Teams to collaborate, chat, and connect in new ways to try to keep their businesses moving forward amidst the challenging global health crisis. I sincerely...
Remote Code Execution Via Path Traversal
github.com/slackhq/nebula is vulnerable to remote code execution via path traversal. Lack of handling of the user-provided unsafe routes in tundarwin.go or tunwindows.go allows an attacker to set a relative-path value and gain privileges of root-user to bypass security controls and to execute...